Does anyone have experience with any of the above options?I would like to be able to safely place and receive secure (=encrypted) calls, for which I believe I should be running a PBX myself. Connecting from my client to the PBX, if it would be in the cloud, of course needs to be secure as well.Ideally I spend as little as possible. I have several linux based routers lying around.

Why do you need your own PBX? There are third party SIP proxy providers (not all SIP providers) you can use for doing ZRTP calls free of charge. Odorik.cz is one of them. As far as the ZRTP works as described, there is no way the SIP proxy provider could "listen" to the calls. They are end to end encrypted.All they can know and store is CDR. (call details records)

If you use Odorik.cz services, call dial the line numbers with ** prefix. For example **300116. In this mode you can use any codec and any encryption which both end points can handle.

If you want to have your own SIP proxy (including RTP) proxy, it is nothing difficult neither expensive. There are many possibilities.Just remember to avoid any solution using Asterisk . Asterisk is not SIP proxy and works as SIP endpoint. Therefore would be the weak point and could "lissen" to all calls which are passing.